目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-532 通过日志文件的信息暴露 类漏洞列表 702

CWE-532 通过日志文件的信息暴露 类弱点 702 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-532指将敏感信息写入日志文件的漏洞，属于信息泄露类安全风险。攻击者常通过读取服务器日志或访问日志存储位置，窃取密码、密钥或个人隐私数据，进而实施身份冒充或横向移动。开发者应避免在日志中记录明文凭证、会话令牌或敏感业务数据，采用数据脱敏、加密存储及严格的日志访问控制机制，确保仅记录必要的非敏感审计信息，从而降低数据泄露风险。

MITRE CWE 官方描述
CWE：CWE-532 将敏感信息写入日志文件 英文：The product writes sensitive information to a log file.
常见影响 (1)
Confidentiality Read Application Data
Logging sensitive user data, full path names, or system information often provides attackers with an additional, less-protected path to acquiring the information.
缓解措施 (4)
Architecture and Design, Implementation Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Distribution Remove debug log files before deploying the application into production.
Operation Protect log files against unauthorized read/write.
Implementation Adjust configurations appropriately when software is transitioned from a debug state to production.
代码示例 (2)
In the following code snippet, a user's full name and credit card number are written to a log file.
logger.info("Username: " + usernme + ", CCN: " + ccn);
Bad · Java
This code stores location information about the current user:
locationClient = new LocationClient(this, this, this); locationClient.connect(); currentUser.setLocation(locationClient.getLastLocation()); ... catch (Exception e) { AlertDialog.Builder builder = new AlertDialog.Builder(this); builder.setMessage("Sorry, this application has experienced an error."); AlertDialog alert = builder.create(); alert.show(); Log.e("ExampleActivity", "Caught exception: " + e + " While on User:" + User.toString()); }
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2019-19756 Lenovo XClarity Administrator 日志信息泄露漏洞 — XClarity Administrator (LXCA) 7.9 High 2020-03-13
CVE-2018-20105 yast-rmt 日志信息泄露漏洞 — SUSE Linux Enterprise Server 15 4.0 Medium 2020-01-27
CVE-2020-5225 SimpleSAMLphp 日志信息泄露漏洞 — SimpleSAMLphp 4.4 Medium 2020-01-24
CVE-2019-14885 Red Hat JBoss Enterprise Application Platform 日志信息泄露漏洞 — JBoss EAP 6.5 - 2020-01-23
CVE-2019-18244 OSIsoft PI Vision 日志信息泄露漏洞 — OSIsoft PI System multiple products and versions 4.7 - 2020-01-15
CVE-2019-11292 Pivotal Software Ops Manager 日志信息泄露漏洞 — Pivotal Ops Manager 6.5 - 2020-01-08
CVE-2019-11293 Cloud Foundry UAA和CF Deployment 日志信息泄露漏洞 — UAA Release 6.5 - 2019-12-06
CVE-2019-10195 Red Hat FreeIPA 日志信息泄露漏洞 — IPA 8.1 - 2019-11-27
CVE-2019-11290 Cloud Foundry UAA和Cloud Foundry cf-deployment 日志信息泄露漏洞 — UAA Release 7.5 - 2019-11-25
CVE-2019-11283 Cloud Foundry SMB Volume 日志信息泄露漏洞 — SMB Volume 8.8 - 2019-10-23
CVE-2019-10212 Red Hat Undertow 日志信息泄露漏洞 — undertow 9.8 - 2019-10-02
CVE-2019-3763 Dell RSA Identity Governance and Lifecycle和RSA Via Lifecycle and Governance 日志信息泄露漏洞 — RSA Identity Governance and Lifecycle 8.8 High 2019-09-11
CVE-2019-11250 Google Kubernetes 日志信息泄露漏洞 — Kubernetes 6.5 - 2019-08-29
CVE-2019-5634 Belwith Products Hickory Smart for Android 日志信息泄露漏洞 — Hickory Smart 4.3 - 2019-08-22
CVE-2019-13515 OSIsoft PI Web API 日志信息泄露漏洞 — OSIsoft PI Web API 6.5 - 2019-08-15
CVE-2019-1961 Cisco Enterprise NFV Infrastructure Software 输入验证错误漏洞 — Cisco Enterprise NFV Infrastructure Software 4.9 - 2019-08-08
CVE-2019-1953 Cisco Enterprise NFV Infrastructure Software 日志信息泄露漏洞 — Cisco Enterprise NFV Infrastructure Software 6.5 - 2019-08-08
CVE-2019-10165 Red Hat OpenShift Container Platform 日志信息泄露漏洞 — openshift 7.1 - 2019-07-30
CVE-2019-11273 Pivotal Software Pivotal Container Service 信息泄露漏洞 — Pivotal Container Service (PKS) 4.3 - 2019-07-23
CVE-2019-10194 oVirt Metrics 日志信息泄露漏洞 — ovirt-engine-metrics 5.5 - 2019-07-11
CVE-2019-11271 Cloud Foundry BOSH 信息泄露漏洞 — BOSH 7.1 - 2019-06-18
CVE-2019-3888 Red Hat Undertow 日志信息泄露漏洞 — undertow 9.8 - 2019-06-12
CVE-2019-3891 Red Hat Satellite Candlepin组件日志信息泄露漏洞 — candlepin 7.8 - 2019-04-12
CVE-2019-3830 OpenStack Octavia 日志信息泄露漏洞 — openstack-ceilometer 5.5 - 2019-03-26
CVE-2018-16856 Red Hat OpenStack Platform 日志信息泄露漏洞 — openstack-octavia 6.2 - 2019-03-26
CVE-2018-19014 多款Drager产品安全漏洞 — Dräger Infinity Delta 6.5 - 2019-01-28
CVE-2018-16889 debug 日志信息泄露漏洞 — ceph 7.5 - 2019-01-28
CVE-2019-0004 Juniper ATP 信息泄露漏洞 — Juniper ATP 5.5 - 2019-01-15
CVE-2019-0021 Juniper ATP 安全漏洞 — Juniper ATP 5.5 - 2019-01-15
CVE-2018-16859 Ansible Playbooks 信息泄露漏洞 — ansible 6.0 - 2018-11-29

CWE-532（通过日志文件的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 702 条 CVE 漏洞。